skills/unity-technologies/skills/sprite-editor/Socket

sprite-editor

Warn

Audited by Socket on Aug 14, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the sprite-editing purpose is coherent with using Unity Editor eval, but the trust chain is not. A Unity-published skill delegates essential setup to another skill and apparently to a third-party `unity-cli` installed via raw GitHub `curl|sh`, creating medium-high supply-chain and transitive-trust risk even without clear exfiltration behavior.

Confidence: 85%Severity: 72%

Audit Metadata

Analyzed At

Aug 14, 2026, 04:46 PM

Package URL

pkg:socket/skills-sh/unity-technologies%2Fskills%2Fsprite-editor%2F@c0a325e5f070330b93a717503302739f850278225f264b535d3bfe7f90662d83